CVE catalog
CVE-2026-44590
UBUNTU-CVE-2026-44590
- Severity
- Critical · CVSS 9.3
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:H/A:N - Published
- Updated
- Source
- [NVD] · [CVE record]
- EPSS
- 1.14% · Oct 25, 2026
Sherlock hunts down social media accounts by username across social networks. Prior to 0.16.1, the GitHub Actions workflow validate_modified_targets.yml is vulnerable to command injection via the pull_request_target trigger. Any GitHub user can execute arbitrary commands on the CI runner and exfiltrate the GITHUB_TOKEN by opening a pull request. No approval, review, or merge is required. This vulnerability is fixed in 0.16.1.
Vulnerable and fixed packages
Distribution-reported package versions and fixes. These do not depend on matching against the OpenFactory package catalog.
| Distribution | Package | Release | Version | Status |
|---|---|---|---|---|
| Ubuntu | sherlock | 24.04 | 0.14.3+git20231006.b336017-1 | vulnerable |
| Ubuntu | sherlock | 24.04 | 0.14.3+git20231225.2813b91-1 | vulnerable |
| Ubuntu | sherlock | 24.04 | 0.14.3+git20240119.e3a09f8-1 | vulnerable |
| Ubuntu | sherlock | 25.10 | 0.15.0-1 | vulnerable |
| Ubuntu | sherlock | 26.04 | 0.15.0-1 | vulnerable |
| Ubuntu | sherlock | 26.04 | 0.15.0-1build1 | vulnerable |
Fixed-version evidence
OpenFactory catalog packages
No matching packages in this catalog.
Observed: